CVE-2012-4404
First published: Mon Sep 10 2012(Updated: )
`security/__init__.py` in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Moinmo Moinmoin | =1.9.0 | |
| Moinmo Moinmoin | =1.9.1 | |
| Moinmo Moinmoin | =1.9.2 | |
| Moinmo Moinmoin | =1.9.3 | |
| Moinmo Moinmoin | =1.9.4 | |
| pip/moin | >=1.9<1.9.5 | 1.9.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16
- http://moinmo.in/SecurityFixes
- http://secunia.com/advisories/50474
- http://secunia.com/advisories/50496
- http://secunia.com/advisories/50885
- http://www.debian.org/security/2012/dsa-2538
- http://www.openwall.com/lists/oss-security/2012/09/04/4
- http://www.openwall.com/lists/oss-security/2012/09/05/2
- http://www.ubuntu.com/usn/USN-1604-1
- https://nvd.nist.gov/vuln/detail/CVE-2012-4404
- https://github.com/moinwiki/moin/commit/b7791166cb3613d07c6e8eea966b4f763b2de660
- https://web.archive.org/web/20151016233452/http://secunia.com/advisories/50885
- https://web.archive.org/web/20151017041746/http://secunia.com/advisories/50474
- https://web.archive.org/web/20151017041755/http://secunia.com/advisories/50496
- https://github.com/advisories/GHSA-g4mx-rm5q-vh24 (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2012-10.yaml
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/severity
- agent/references
- agent/last-modified-date
- agent/softwarecombine
- agent/weakness
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/author
- collector/github-advisory
- source/GitHub
- alias/GHSA-g4mx-rm5q-vh24
- alias/CVE-2012-4404
- agent/tags
- collector/github-advisory-latest
- vendor/moinmo
- canonical/moinmo moinmoin
- version/moinmo moinmoin/1.9.0
- version/moinmo moinmoin/1.9.1
- version/moinmo moinmoin/1.9.2
- version/moinmo moinmoin/1.9.3
- version/moinmo moinmoin/1.9.4
- package-manager/pip